{"id":437,"date":"2020-06-18T08:27:20","date_gmt":"2020-06-18T08:27:20","guid":{"rendered":"http:\/\/jeedom.sigalou-domotique.fr\/microsoft-exchange-365-imap-incompatible-avec-mfa-multi-factor-authentication"},"modified":"2021-02-20T09:24:40","modified_gmt":"2021-02-20T07:24:40","slug":"microsoft-exchange-365-imap-incompatible-avec-mfa-multi-factor-authentication","status":"publish","type":"post","link":"https:\/\/www.sigalou-domotique.fr\/en\/microsoft-exchange-365-imap-incompatible-avec-mfa-multi-factor-authentication","title":{"rendered":"Microsoft Exchange 365, IMAP incompatible with MFA (Multi-Factor Authentication)"},"content":{"rendered":"

\"imap365\"<\/p>\n

 <\/p>\n

This little tutorial in the form of a testimony after days of fruitless research.<\/p>\n

I hope that this page will be useful to others.<\/p>\n

<\/p>\n

I have users on Exchange OnLine 365 who want to use Thunderbird. And so they need IMAP access.<\/p>\n

For the past few months, Microsoft has been making MFA identification recommended by going so far as to put this in the default configuration.<\/p>\n

 <\/p>\n

So if you enable MFA, your users will not be able to use IMAP, do not look, it is not compatible.<\/p>\n

To do so, it is necessary either to use conditional access which requires a licence: an Azure Active Directory P1 or P2 licence: https:\/\/docs.microsoft.com\/fr-fr\/azure\/active-directory\/conditional-access\/overview#license-requirements<\/a><\/p>\n

Either disable the default security settings and sharpen the MFA individually (which is not recommended by Microsoft). I think that at least the administrative counties must be in MFA, it is really a minimum.<\/p>\n

 <\/p>\n

Here is the procedure:<\/p>\n

Disable the default security settings:<\/h2>\n

https:\/\/docs.microsoft.com\/fr-fr\/azure\/active-directory\/fundamentals\/concept-fundamentals-security-defaults<\/a> <\/p>\n

To disable the default security settings in your directory:<\/span><\/p>\n

    \n
  1. Log in to \u202fAzure Portal<\/a>\u202f as security administrator, conditional access administrator or general administrator.<\/span><\/li>\n
  2. Go to \u202fAzure Active Directory<\/strong>\u202f>\u202fProperties<\/strong>.<\/span><\/li>\n
  3. Select Manage Default Security Settings<\/strong>.<\/span><\/li>\n
  4. Define Enable Default Security Settings<\/strong> on No<\/strong> using the toggle button.<\/span><\/li>\n
  5. Select Save<\/strong>.<\/span><\/li>\n<\/ol>\n

    Enable MFA for users who do not use MFA (minimum Adminsitrators)<\/h2>\n

    https:\/\/account.activedirectory.windowsazure.com\/UserManagement\/MultifactorVerification.aspx?BrandContextID=O365<\/a><\/p>\n

     <\/p>\n

    Other information:<\/h2>\n

    Note:<\/strong> : With Outlook, no worries with the MFA<\/p>\n

    If you set the box in Outlook automatically using autodiscover, you can have the MFA enabled because Outlook uses modern authentication and it supports the MFA. <\/p>\n

    https:\/\/docs.microsoft.com\/fr-fr\/office365\/enterprise\/hybrid-modern-auth-overview<\/a> <\/p>\n

    https:\/\/docs.microsoft.com\/fr-fr\/microsoft-365\/admin\/security-and-compliance\/set-up-multi-factor-authentication?view=o365-worldwide<\/a> <\/p>\n

     <\/p>\n

    Why is Microsoft pushing for MFA?<\/h2>\n

    Read this article:<\/p>\n

    \"IMAP<\/p>\n

    https:\/\/www.cybercureme.com\/hackers-bypass-multi-factor-authentication-to-hack-office-365-g-suite-cloud-accounts-using-imap-protocol\/<\/a><\/p>\n

    https:\/\/www.zdnet.com\/article\/microsoft-details-the-causes-of-its-recent-multi-factor-authentication-meltdown\/<\/a><\/p>\n

     <\/p>","protected":false},"excerpt":{"rendered":"

      Ce petit tuto sous forme de t\u00e9moignage apr\u00e8s des jours de recherche infructueuse. J’ai espoir que cette page sera utile \u00e0 d’autres.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[14,24],"tags":[],"class_list":["post-437","post","type-post","status-publish","format-standard","hentry","category-domotique","category-microsoft-365"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/comments?post=437"}],"version-history":[{"count":0,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/437\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/media?parent=437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/categories?post=437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/tags?post=437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}